KR100586234B1 - A flow-based packet generating apparatus for internet traffic, and a method thereof - Google Patents

Abstract

The present invention relates to an apparatus and method for generating a flow-based packet for generating an application flow packet and statistical information corresponding to a characteristic of traffic flowing through an internet network. An apparatus for generating a flow-based packet according to the present invention includes: an operation parameter and application characteristic information generator for defining and processing operation parameter and application characteristic information; A parser configured to parse the operation parameter and the application characteristic information provided from the operation parameter and the application characteristic information generator; A meta flow generator that defines and processes meta flow data based on operation parameters and application characteristic information; A meta packet data generation unit configured to generate and transmit meta packet data according to the meta flow data; And a packet generation unit generating a packet according to meta packet data and storing the packet in a temporary buffer. According to the present invention, it can be usefully used for test traffic generation for function and performance inspection of flow-based Internet traffic measurement system, Internet application analysis system and intrusion detection system.

Packet Generation, Flow-Based, Internet Traffic, Application Patterns, Metaflows

Description

A flow-based packet generating apparatus for internet traffic, and a method

1 is a block diagram of a flow-based packet generation apparatus for generating Internet traffic according to an embodiment of the present invention.

2 is an operation flowchart of a flow-based packet generation method for generating Internet traffic according to an embodiment of the present invention.

The present invention relates to a flow-based packet generating apparatus and method for generating internet traffic, and more particularly, to a flow for generating internet traffic for generating an application flow packet and statistical information corresponding to the characteristics of traffic flowing through the internet network. An apparatus and method for generating a flow-based packet are provided.

Early Internet traffic measurement systems simply measured the number and size of packets and provided simple analysis results such as Internet line utilization and traffic size. However, with the rapid increase in the number of Internet users, network size, and traffic volume, a flow-based traffic measurement system has emerged. This traffic measurement method reduces the amount of measurement by processing the collected packets into a flow, and at the same time makes it possible to more clearly understand the characteristics of the Internet traffic. Here, the flow refers to a set of packets having common characteristics.

However, most of the flow-based traffic measurement systems published to date provide a method of determining only by referring to a port number in determining a traffic generating application.

Recently, applications that make up the majority of Internet traffic use a peer-to-peer transmission scheme and use arbitrary ports rather than specific representative port numbers. As a result, the existing Internet traffic measurement system that performs port number-based application analysis cannot identify accurate Internet traffic characteristics.

For this reason, recently released measurement systems provide the ability to accurately analyze traffic-inducing applications by inspecting the payload, rather than simply referring to packet header information.

On the other hand, as a prior art, Korean Patent Application No. 1999-51587 (application date: November 19, 1999) discloses the invention named "Internet synthetic traffic generator and its method".

Specifically, the present invention relates to an internet traffic generator and a method for synthesizing and describing the traffic characteristics of users using services having different characteristics used in the simulation into a single traffic characteristic. Although it is possible to improve the method of making an internet simulator by considering the characteristics of Internet traffic, the application flow according to traffic generation is not considered.

On the other hand, existing traffic generating devices such as iPuff or SmartBits, which have been used to check the function and performance of the Internet traffic measurement system, repeatedly generate the same packet or repeatedly generate a simple flow packet. Provide the function.

However, this type of traffic generating apparatus according to the prior art is not capable of generating traffic in which dozens or hundreds of types of application flow packets are mixed, and it is also impossible to insert a pattern uniquely identified in each application into the payload of a specific packet. There is a problem. Therefore, a need arises for a test traffic generation unit necessary for the function and performance inspection of a flow-based traffic measurement system having a payload inspection function that has been recently developed.

SUMMARY OF THE INVENTION An object of the present invention for solving the above problems is to provide an apparatus and method for generating a flow-based packet for generating internet traffic that can adjust traffic bandwidth distribution for each application by enabling traffic generation in which application flow packets are mixed. will be.

In addition, another object of the present invention for solving the above problems is to insert a pattern uniquely identified in the payload of a particular packet to generate a flow packet included in the payload at a specified line speed. An apparatus and method for generating a flow-based packet are provided.

As a means for achieving the above object, the flow-based packet generation apparatus according to the present invention,

An operation parameter and application property information generator for defining and processing the operation parameter and the application property information;

A parser configured to parse the operation parameter and the application characteristic information provided from the operation parameter and the application characteristic information generator;

A meta flow generator for defining and processing meta flow data based on the operation parameters and application characteristic information;

A meta packet data generation unit which creates and transmits meta packet data according to the meta flow data; And

Packet generation unit for generating a packet according to the meta packet data, and storing in a temporary buffer of a fixed size

Characterized in that it comprises a.

Here, the flow-based packet generating apparatus according to the present invention, the application characteristic database for storing the application characteristic information parsed by the parser; A meta flow database for storing meta flows generated by the meta flow generating unit; And a packet database configured to attach and store a timestamp considering the line speed to the packet generated by the packet generator.

On the other hand, as a means for achieving the above object, the flow-based packet generation method according to the present invention,

a) parsing operation parameters of the packet generation unit and application characteristic information required for packet generation and storing them in an application characteristic database;

b) generating metaflow data by referring to the application characteristic information and storing the metaflow data in a metaflow database;

c) generating meta packet data with reference to the meta flow data, and generating a packet according to the generated meta flow data; And

d) attaching the timestamp considering the line speed to the generated packet and storing it in the packet database;

Characterized in that it comprises a.

Here, the flow-based packet generation method according to the present invention may further include e) updating statistical information on the generated packet.

According to the present invention, the present invention provides a packet generating unit and method including various application flows and application patterns similar to the Internet traffic, and also discloses an apparatus and method for generating similar internet traffic in consideration of characteristics of internet traffic in which various applications are mixed. It can be used to generate test traffic for functional and performance checks, such as flow-based Internet traffic measurement systems, Internet application analysis systems, and intrusion detection systems.

The above objects, features, and advantages will become apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

First, in order to examine the functionality of a system that analyzes not only the packet header but also the patterns included in the payload, such as a flow-based traffic measurement system or an intrusion detection system for generating Internet traffic, various application flow packets and accurate statistical information are examined. You need test traffic that you know. Here, the flow refers to a set of packets having common characteristics, and the pattern means a string or byte value that can uniquely identify the application.

An embodiment of the present invention discloses a method for defining various application-specific flow characteristics and a distribution of bandwidth usage per application, and discloses a method for generating a packet based on the characteristics defined in this way, and also applies the flow- An apparatus for generating and storing base packets is disclosed.

Specifically, embodiments of the present invention describe traffic characteristics and distribution by application, such as 1) communication protocols, ports of use, patterns, and amounts generated from totally generated traffic uniquely designated for each Internet application, and 2) the Internet described above. Create metaflow information based on traffic characteristics and distribution, 3) create metapacket information based on metaflow information, 4) generate packets according to metapacket information and specified bandwidth, and 5) Collect and store statistical information, and finally, 6) apply them to generate flow-based packets.

1 is a block diagram of a flow-based packet generation apparatus for generating Internet traffic according to an embodiment of the present invention.

Referring to FIG. 1, an apparatus for generating a flow packet according to an exemplary embodiment of the present invention may include an operation parameter and an application characteristic information generator 110, a parser 120, an application characteristic database 130, and a metaflow generator. 140, the meta flow database 150, the meta packet data generating unit 160, the packet generating unit 170, and the packet database 180, may be included in the flow packet generating apparatus according to the embodiment of the present invention. The operation is as follows.

First, the parser 120 parses the operation parameter and the application characteristic information provided from the application parameter information generation unit 110 and stores the operation parameter and the application characteristic information in the application characteristic database 130.

In this case, the operation parameter describes a rule to be followed when the flow packet generator generates a packet, and includes the following attributes:

1) a metaflow database size that specifies the size of the buffer space where metaflow data is stored;

2) the bandwidth of the generated traffic specifying the line speed generating the traffic, where the larger the bandwidth, the tighter the time interval (difference in timestamp value) between packets;

3) maximum allowable snapping value for long packets, where the size is generated limited in size according to the maximum allowed snapping value even if the actual packet is large;

4) size distribution of packets having a size of at least 42 bytes and at most 1486 bytes; And

5) Packet distribution by communication protocol such as TCP, UDP, ICMP.

On the other hand, the application characteristic information defines the information to be included in the packet when generating the application-specific flow packet and includes the following attributes:

1) the name of an application commonly referred to by Internet users;

2) the number of port numbers used by the application;

3) the percentage of application flow traffic to total traffic;

4) port number;

5) pattern values in the payload that uniquely identify the application, represented as a string or byte string;

6) the location range of the packet where the pattern is found; And

7) The range of byte positions in the packet where the pattern is found.

Meanwhile, based on the operation parameter and application characteristic information stored in the application characteristic database, the metaflow generator 140 generates metaflow data and stores the metaflow data in the metaflow database 150. In this case, one metaflow data stored in the metaflow database 150 records a characteristic of one application flow, and also includes a characteristic of a packet to be generated through this.

Here, the attributes defined in the metaflow data are as follows:

1) Internet address and port number of source and destination, communication protocol type;

2) the total number of packets belonging to one application flow;

3) Number of Flow Packets to be Generated in the Future--In this case, when the number of flow packets reaches zero, it indicates that one application flow is terminated, and the corresponding metaflow data is deleted from the metaflow database and replaced with new metaflow data. Therefore, the size of the metaflow database is always constant;

4) Metaflow data in the metaflow database are processed sequentially in a round-robin manner, the number of flow packets to be generated in one order;

5) average length of application flow packets;

6) pattern values that uniquely identify the application;

7) range of packets in which the pattern exists;

8) the range of byte positions at which the pattern value begins in the packet in which the pattern exists; And

9) For applications using the TCP communication protocol, a flow exit type that indicates whether it is a normal end (FIN) or an abnormal end.

Meanwhile, the meta packet data generator 160 creates meta packet data according to the meta flow data of the meta flow database 150, and transfers the meta packet data to the packet generator 170. In this case, the meta packet data is a rule for generating an application flow packet such as information on the number of times to make a packet in the entire flow, the number of packets to be continuously generated, whether normal / abnormal ends, pattern information, and average packet size. Is defined.

Next, the packet generator 170 generates a packet according to meta packet data and stores the packet in a temporary buffer having a fixed size. The size of the temporary buffer is determined in proportion to the traffic bandwidth. For example, if the traffic bandwidth is B and the size of the temporary buffer is defined as 1 / N of the bandwidth, the temporary buffer is the size of B / N.

When M packets are filled in the fixed buffer defined as described above, the total packet is the amount of traffic generated during 1 / N seconds, and thus the time interval between packets becomes 1 / (N × M) seconds. Therefore, if the time when the first packet is generated is T, the next packet generation time is T + 1 / (N × M), and this value is stored in the timestamp field and added to the front of the generated packet to add the packet database 180. )

Accordingly, the packet generator according to the embodiment of the present invention updates statistical information about the generated packet.

2 is a flowchart illustrating a flow-based packet generation method for generating Internet traffic according to an embodiment of the present invention.

Referring to FIG. 2, in the flow-based packet generation method for generating Internet traffic according to an embodiment of the present invention, first, an operation parameter of a packet generator and application characteristic information required for packet generation are parsed and stored in an application characteristic database. In operation S201, metaflow data is generated by referring to application characteristics and stored in the metaflow database (S202).

Next, meta packet data is generated with reference to meta flow data (S203), and a flow packet for generating a packet is generated based on this and stored in a temporary buffer (S204).

Next, when the buffer is full, the unit time is calculated by dividing the unit time by the number of packets (S205), and the time stamp is added to the packet in consideration of the line speed in the generated packet and stored in the packet database (S206). . Finally, the flow packet statistics information is updated (S207).

As a result, embodiments of the present invention define mechanisms for describing application-specific characteristics and bandwidth distributions, define metaflow data and metapacket data for generating flow packets, and timestamp packets according to specified line rates. A flow packet generation unit for defining a recording method, defining statistical information of generated flow packets, and finally applying these to generating flow packets is disclosed.

The flow packet generation unit and method of the present invention as described above is implemented as a program and can be read by a computer-readable CD-ROM, a RAM, a ROM, a floppy disk, a hard disk, a magneto-optical disk. It may be stored in a recording medium such as a flash memory, and the flow packet generator and method may be implemented by executing a program stored in the recording medium on a computer.

While the invention has been shown and described in connection with specific embodiments thereof, it will be appreciated that various modifications and changes can be made without departing from the spirit and scope of the invention as indicated by the claims. Anyone who owns it can easily find out.

According to the present invention, by adjusting the traffic bandwidth distribution for each application, and by inserting a pattern uniquely identified in each application into the payload of a specific packet to generate a flow packet included in the payload according to a specified line speed, It can be useful for generating test traffic for functional and performance checks, such as flow-based Internet traffic measurement systems, Internet application analysis systems, and intrusion detection systems.

Claims (9)

In the flow-based packet generation unit for generating Internet traffic, An operation parameter and application property information generator for defining and processing the operation parameter and the application property information; A parser configured to parse the operation parameter and the application characteristic information provided from the operation parameter and the application characteristic information generator; A meta flow generator for defining and processing meta flow data based on the operation parameters and application characteristic information; A meta packet data generation unit which creates and transmits meta packet data according to the meta flow data; And A packet generator for generating a packet according to the meta packet data and storing it in a temporary buffer Flow-based packet generation device comprising a. The method of claim 1, The operation parameter indicates a rule required by the packet generator to generate a packet, and the application characteristic information indicates information to be included in the packet when generating a flow packet for each application. Device. The method of claim 1, The meta packet data is a rule for generating flow packets for each application including information on the number of packets to be made in the entire flow, the number of packets to be continuously generated, whether normal / abnormal ends, pattern information, or average packet size. Apparatus for generating a flow-based packet, characterized in that for representing. The method of claim 1, The meta flow data is recorded in the characteristics of the application flow, flow-based packet generation apparatus characterized in that it represents the characteristic information of the packet to be generated through this. The method of claim 1, The size of the temporary buffer for storing the packet generated by the packet generator has a fixed size, characterized in that it is determined in proportion to the Internet traffic bandwidth. The method of claim 1, An application characteristic database storing application characteristic information parsed by the parser; A meta flow database for storing meta flows generated by the meta flow generating unit; And A packet database for attaching and storing a time stamp considering a line speed to a packet generated by the packet generator. Apparatus for generating a flow-based packet further comprising. The method of claim 6, And wherein the packet database stores a generation time of a next packet in a timestamp field and is added to and stored in front of the generated packet. In the flow-based packet generation method for generating Internet traffic, a) parsing operation parameters of the packet generation unit and application characteristic information required for packet generation and storing them in an application characteristic database; b) generating metaflow data by referring to the application characteristic information and storing the metaflow data in a metaflow database; c) generating meta packet data with reference to the meta flow data, and generating a packet according to the generated meta flow data; And d) attaching the timestamp considering the line speed to the generated packet and storing it in the packet database; Flow-based packet generation method comprising a. The method of claim 8, e) updating the statistical information for the generated packet.

Images